Import CSV and update multi value field

Greetings,

I'm importing large CSV files into elasticsearch using logstash. I'm prefixing specific values like this:

    filter {      
       if [path] =~ "xyz" {
         csv {
              separator => ";"
             columns =>
              [
                "IOT",
              "name",
                "surname",
               "addr",
               "XID",
               "ticketid"
              ]
          }

           if [IOT]{
           mutate {
              update => { "IOT" => "v-%{IOT}" }
          }
            } 

Recently we discovered multi values fields in those files and now I want to add the prefix to each value in the field.

Example.csv

 IOT;name;surname;addr;XID;ticketid
 1;Mueller;Hans;42553;1;['9', '12', '13', '14']
 2;Meier;Peter;42873;2;['8', '14']

Right now those lines are beeing read like v-['8', '14'].

The output I need is something like [v-8, v-14].

Is there a way to achieve this in the logstash config? Maybe something like for each statement?

Also not sure if the multi value syntax in the csv is correct.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.